---
typeId: req
recordId: benac-wasm-002
fields:
  title: WASM mediated access restrictions
  statement: >-
    A package operation using a WASM artifact shall not receive DOM access, direct
    Document Store access, direct Blob Store access, raw secrets, raw authentication
    credentials, unrestricted network access, unrestricted device access, unrestricted
    filesystem access, or unrestricted host API access.

    A package operation using a WASM artifact shall access host resources only through
    the WASM package-host calling convention and granted capabilities.

    A package operation using a WASM artifact shall fail closed when it imports,
    exports, reads, writes, or calls outside the calling convention.

    This requirement shall not classify packages.
  rationale: >-
    WASM artifact use must remain host-mediated. Artifact format does not grant
    authority.
  verification: >-
    WASM fixtures attempting forbidden imports, direct host access, direct network, raw
    secrets, raw filesystem, direct document store, direct blob store, or DOM access fail
    closed with stable diagnostics.
  testable: true
  status: draft
  area: BENAC-WASM
  sourceDocument: user-requested schema-first requirements cleanup
  sourceVersion: 2026-05-06
  sourceSections:
    - Package authoring
  order: 87.17
---
